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16 MC 464 (PKC) 

AO 93 (SDNY Rev. 05/10) Seaioh and Seizure Wairent 



United States District Court 

for the 

Southern District of New York 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 

A Laptop Computer, Further Described Below and In 
Attachment A 


* 6 mag 


Case No. 



To: 


SEARCH AND SEIZURE WARRANT 

Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Southern District of _ New Yor1< 


(Identify the person or describe the property to be searched and give Its location ): 

A Laptop C omnntor. Fur ther Described As a Silver Dell Inspiron 15 7000 Series (7548) Lapto p Computer Be aring 
Service Tag fontalnlng a Toshiba One Terabyte Hard Drive Bearing Serial Numbe] pnd That 

Is Currently Housed at the Federal Bureau of Investigation, New York Field Office, as descrlbemn nuacnment A. b6 
The person or property to be searched, described above, is believed to conceal (identify the person or describe the 
property to be seised)'. b7C 

See Attachment A 


OTHER Sealed 


I find that the affidavit(s), or any recorded testimony, establish probable 
property. 

YOU ARE COMMANDED to execute this warrant on or before 


cause to search fcpd seize tKe,p6rsbn or 

* l_A __ T ' Ll. _-.IOj ii. . lJl J 


□ in the daytime 6:00 a.m. to 10 p.m. fvf at any time in the day or night as 11 , % ( ... .. 

established. \‘ , ■ ’.. ..., 

• 

Unless delayed notice is authorized below, you must give a copy of the warrant and a tncteipj'fojr^q property 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy 'and receipt at the 
place where the property was taken. 

' The officer executing this warrant, or an officer present during fire execution of the warrant, must prepare an 
Inventory as required by law and promptly return this warrant and inventory to the Clerk of the Court. 
fit Upon its return, this warrant and inventory should be filed under seal by the Clerk of the Court, 

USW Initials 

□ I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay . 

of trial), and authorize the officer executing this warrant to delay notice to the nersWrl Wt)6' or, whose property, will be 
searched or seized (check the appropriate box) Ofor _days (not to excecdpfy \ ( 


Dale and time issued: 


□until, the facts justifying, tbp later spec'iflc'date'of-:' 

!Q fooltL fC * ’ ^ '' -" M 


City and state: New Yor k. New York 


w' : v. >{'$ V-v 

H 9i) b(a t;[e.'K9vin-'Nafha.iMl, fox 


V Prtolethnpmearidflili:';' 

‘ /.'0V(In• 
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AO 93 (Rev. 01/09) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 



Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is con-ect and was returned along with the original warrant 
to the Court. 


Date: _ _ 

Executing officer's signature 


Printed name and title 
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Attachment A 


I. Device To Be Searched 


The device to be s earched is a silver Dell Inspiron 15 7000 Series (7548) laptop computer 
heat ing service tael b ontaining a Toshiba one terabyte hard drive bearing serial 


■eatin g se 
numbeT” 


1 (the Subject Laptop), and that is currently housed at the Federal 


Bureau of Investigation, New York Field Office, 26 Federal Plaza, New York, New York 
10278. 


b6 

b7C 

OTHER Sealed 


II. Review of ESI on the Subj ect Devices 


Law enforcement personnel (including, in addition to law enforcement officers and 
agents, and depending on the nature of the ESI and the status of the investigation and related 
proceedings, attorneys for the government, attorney support staff, agency personnel assisting the 
government in this investigation, and outside technical experts under government control) are 
authorized to review the ESI contained on the Subject Laptop for the following evidence, 
contraband, fruits, and/or other items illegally possessed in violation of Title 18, United States 
Code, Section 793(e) and (f) (the Subject Offenses): 


1. Data and information associated with ^ Adaption, use, maintenance, backup, 

auditing, and security functions of the Subject not limited td: 

a. Emails and attachments, in . , 

b. User and system files stored?*#*including file fragments and 
items carved from unallocat^fjee^‘ Hr 

c. Logs, configuration files, and backups; 

d. Executable code and scripts; and 

e. Documents, database files, and spreadsheets; 

2. Data and information electronically stored on the SgfLaptop related to 
co mmuni cations with email accounts used by former Secretary of State Hillary Clinton during 
her tenure as Secretary of State; 


3. Data and information on the Subject Laptop that might identify the . 

persons who accessed classified information present on the Subject Laptop, including 
addresses, telephone numbers and other identifiers, email addresses, business information, the 
length of service (including start date), types of services utilized, means and source of payment 
for services (including any credit card or bank account number), and information about any 
domain name registration; and 

4. Data and information stored on the Subject Laptop that might identify activity 
related to a computer intrusion, including, but not limited to evidence of malware or viruses, 
executable code or scripts, log files, audit files, system files, user and account information, IP 
addresses, computer hardware addresses, intrusion-detection logs, firewall and other network 
logs, anti-virus logs or anti-malware logs. 
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JH. Seizure for Later Review of Electronically Stored Information 

A. Seizure of Computer and Media 

This warrant authorizes the seizure of a computer and electronic storage media as set 
forth below. In lieu of seizing any particular electronic storage media, this warrant also . 
authorizes the copying of electronically stored information for later review. Electronic storage 
media which may be seized or copied include without limitation: 

Computer devices, electronic media and electronic storage devices, including, but not 
limited to, a computer, disk drives, modems, thumb drives, personal digital assistants, smart 
■ phones, digital cameras, and scanners and the data within the aforesaid objects relating to said 
materials, which may contain information within the scope of this warrant. 

Any physical keys, encryption devices, and similar physical items that are necessary to 
gain access to the computer equipment, storage devices or data mentioned above, or any 
passwords, password files, test keys, encryption codes or other information necessary to access 
the above-mentioned computer equipment, storage devices or data. 

B. Review of Electronic Storage Media and Electronically Stored Information • 

Following creation of forensic image copies as may be necessary to preserve the integrity 
of seized electronically stored information, law enforcement personnel (who may include, in 
addition to law enforcement officers and agents, attorneys for the government, attorney support 
staff, and outside technical experts under government control) are authorized to review the seized 
information for information and data within the scope of this warrant. 

In conducting this review, law enforcement personnel may use various techniques to 
determine which files or other ESI contain evidence, contraband, fiuits and/or other items 
illegally possessed in violation of the Subject Offenses. Such techniques may include, but shall 
not be limited to, surveying various file directories or folders and the individual files they 
contain; conducting a file-by-file review by “opening” or reading the first few “pages” of such 
files in order to determine their precise contents; “scanning” storage areas to discover and 
' possibly recover recently deleted data; scanning storage areas for deliberately hidden files; and 
performing electronic “key word” searches through all electronic storage areas to determine 
whether occurrences of language contained in such storage areas exist that are related to the 
subject matter of the investigation. Forensicaliy trained law enforcement personnel may also 
search for and attempt to recover “deleted,” “hidden,” or encrypted data to determine Whether the 
data falls within the list- of items to be seized as set forth in this affidavit ESI that is responsive 
to the warrant will be identified and/or copied for further use in the investigation and any 
resultant prosecution. 
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AO 106 (Rev. 06/09) Application for r.teii&'fc'kraot 


United States District Court 

'for the 

• Southern District of New York 



In the Matter of the Search of 

(Briefly describe the properly to be searched 
or identify the person by name and address) 

A Laptop Computer, Further Described Below and In 
Attachment A 


AJPl*Mr-kTION FOR a search warrant 

I, a federal law enforcement ofuas' or an attorney for the government, request a search warrant and state under 
penalty ofperjuty that I have Tp bejieve that on the following person or property (Identify the person or describe the 

/ '/^j!^/op Z ' e cf ornmiien'^ tfierffflfgS:fed Asu Silver Dell Insplron 15 7000 Series (7548) Lapto p Computer Bea ring 
Service Tag [_ j fontathliw a •Toshiba One Terabyte Hard Drive Bearing Serial Numbei j 


* , 


b6 

b7C 


Southern 


District of 


New York 


located in the _ 

person or describe the property to be seized)', 

PLEASE SEE ATTACHED AFFIDAVIT AND ATTACHMENT A. 

The basis for tho search under Fed. R. Grim. P. 41(o) is (check one or more): 
fif evidence of a crime; 

sf contraband, fruits of crime, or other items illegally possessed; 

□ property designed for '•$&>, feeended for use, or used in committing a crime; 

□ a person to be arrested cSii>xrson who is unlawfully restrained. 

The search is related in s, f-. k’Mion oft 


’, thore is now concealed (identify the OTHER Sealed 


Code Section 
18 U.S.C. § 793(e) and (f) 




Offense Description 

Gathering, transmitting or losing defense Information 


The application is based on these facts: 

PLEASE SEE ATTACHED AFFIDAVIT AND ATTACHMENT A. 

sf Continued on the attached sheet. 

D Delayed notice of_■_ days (give exact ending date if more than 30 days: _ 

under 18 U.S.C. § 3103a, the basis of which is sot forth on tho attached sheet 


) is requested 



b6 
b7C 
OTHER Sealed 


Sworn to before me and signed in my presence. 

Date: 10/30/2016 _ 

City and state: New York, New York 


Si?.'.:-" • \ 

, 1 / ,, . *;•■ 



Hbootfebja -Keyi/i'^fogrilel 'Fox 
D/ntnfD- 
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UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF NEW YORK 


In the Matter of the Application of the United 
States Of America for a Search Warrant for a 
Laptop Computer, Further Described As a Silver 
Dell Inspiron 15 7000 Series (75 48) Laptop 
Computer Bearing Service Tag 1_ jl 


Containing a Toshiba One Terabyte H ard Drive 
Bearfog h nd That is 

CurrdU^: at Ihe Federal - Bureau of 

Inve^a^# v; |j 5 ^?York Field Office, 26 Federal 
Plaza^ York 10278. 




SOUTHERN DISTRICT OF NEW YORK) ss.: 


TO BE Elf/ED UNDER SEAL/ 

' Agent Affidavit in Su-f3»-.v .;*f 
Application for Search WifiYa&t 


being duly sworn, deposes and says: 


INTRODUCTION AND AGENT BACKGROUND 


1 . 


2. This affidavit relates to a criminal investigation concerning foe improper 


b6 

b7C 

OTHER Sealed 


b6 

b7C 

OTHER Sealed 


b6 

b7C 

OTHER Sealed 


transmission and storage of classified informatibn on unclassified email systems and servers. 


The.investigation began as a result of a review of emails undertaken by the U.S. Department of 
State (State Department) in connection with Freedom of Information Act (FOIA) litigation. 



V 
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During this FOIA. rc^sS^p^^^termined that certain emails containing classified information 
were sent and recd^^^p^6-maufliorized for the transmission or storage of suck 
information. On or about July 6,2015, the Inspector General for file Intelligence Community 
notified the FBI of a potential compromise of classified information invo5?i%'aie emails 
discovered through the FOIA review. After an initial review of the matter thoiiBI opened a 
criminal investigation to, among other things, identify any unauthorized systems which the 
emails in question have transited, identify any person(s) who may have introduced’gls&dfied 

' j|i; 

information onto unauthorized systems and all circumstances surrounding such introduction, 
identify any person(s) who may have transmitted such information over any such systems, and 

• J * 

identify whether classified information has been compromised through computer intrusions or 
unauthorized access into these systems. 

3. The FBI’s investigation has established that emails containing classified' 
information were transmitted and stored on multiple forms of electronic media. One of the items 
identified as having contained such emails is a server which was used by former Secretary of 
State Hillary Rodham Clinton (Clinton) dining her tenure at the State Department to transmit, 
receive, and store email fe a personal email account or accounts sift; maintained (the Clinton 
Server). One domain on die Clinton Server was @clintonemail.coso, 

4. In recent mrcfe, 0ie. FBI and the Department of Justice have made public 
statements concerning ifce conclusion of the investigation. However, as with any case, if new, 

7 flL / * 

pertinent information comes to lig hf. after an investigation is completed, the FBI will take 
appropriate investigative steps to determine the significance of that information. 

b6 
b7C 

OTHER Sealed 


5. 


T 
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la executing the search of the laptop computer (the Subject Laptop] 


Laptop to segregate email£ 


[FBI agents sorted the emails on the Subject 

As a result. 


the FBI reviewed non-content header information for emails on the Subject Laptop to facilitate 
its search. In so doing, the FBI observed non-content header information indicating that 


thousands of emails ofl 


resided on the Subject 


Laptop. Because! 


emails were outside of the scope! 


the FBI did not review the content of those emails. 


7. 



The non-content header information that 


FBI agents reviewed rsrSu Subject Laptop indicates that the emails on the Subject Laptop 


include emails sent and/or received bjl 


Imd at a 


[mail account appearing to belong td 


ps well as correspondence between cme or 


both of these accounts and State Department email accounts during and arounc£ 


Jfbe FBI’s investigation of the improper transmission and storage of 


classified information on unclassified email systems and servers has established that emails 
con taining classified information were transmitted through multiple email accounts used by 


pci ud hi a 


mC3- accounts. 


b6 
b7C 
OTHER Sealed 


b6 
b7C 
OTHER Sealed 


b6 
b7C 
OTHER Sealed 


8 . 


The Subject Laptop, which is a silver Dell Inspiron 15 7000 Series (7548) laptop b6 

b7C 


I • # < D/U 

computer bearing service taa containing a Toshiba one terabyte hard drive bearing other Sealed! 


3 
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serial nombelT 


Jis currently housed at the Federal Bureau of Investigation, New 


York Field Office, 26 Federal Plaza, New York, New York 10278, within the Southern District 


b6 i 

b7C | 

OTHER Sealed 


of New York, as described in Attachment A to this affidavit. There is probable cause to believe 
that the Subject Laptop contains evidence, contraband, fruits, and/or other items illegally 
possessed in violation of 18 U.S.C., § 793(e) and (f). 

9. I make this affidavit in support of an application pursuant to Rule 41 of the 

Federal Rules of Criminal Procedure for a warrant to search the Subject Laptop for the items and 
information described in Attachment A. The facts set forth in this affidavit are based on my 
personal knowledge, knowledge obtained during my participation in this investigation, and 
information from other FBI and U.S. Government personnel. Because this affidavit is submitted 
for the limited purpose of establishing probable cause in support of the application for a search 
warrant, it does not set forth each and every fact that I or others have learned during the course of 
this investigation. Where the contents of documents and the actions, statements, and 
conversations of others are reported herein, they are reported in substance and part, except where 
otherwise indicated. 


ST AT UTO R YAU THORITY A MD JJaemmOMS 

10. For die reasons set forth below, I believe thatthere is probable cause to believe 

that the Subject Laptop contains evidence, contraband, fruits, and/or other items illegally 
possessed in violation of Title 18, United States Code, Section 793(e) and (f)(the Subject 


Offenses). 

11. Under 18 U.S.C. § 793(e), “[Wjhoever having unauthorized possession of, acoess 
to, or control over any document... or information relating to the national defense which 
information the possessor has reason to believe con?. • ?«ed to the injury of the United States 

• 4 

i 
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or to the advantage of any foreign nation, willfully communicates, delivers, transmits or causes 
to be communicated, delivered, or transmitted” or attempts to do or causes the same “to any 
person not entitled to receive it, or willfully retains the same and fails to deliver it to the officer 
or employee of the United States entitled to receive if' shall be fined or imprisoned not more 
than ten years, or both. 

12. Under 18 U.S.C. § 793(f), “[w]hoever, being entrusted with or having lawful 
possession or control of any document... or information, relating to the national defense” either 
“(1) through gross negligence permits the same to be removed from its proper place of custody 
or delivered to anyone in violation of his trust, or to be lost, stolen, abstracted, or destroyed,” or 
"(2) having knowledge that the same has been illegally removed from its proper place of custody 
or delivered to anyone in violation of its trust, or lost, or stolen, abstracted, or destroyed, and 
fails to make prompt report of such loss, theft, abstraction; or destruction to his superior officer” 
shall be fined or imprisoned not more than ten years, or both. 

13. Under Executive Order 
is owned by, produced by or for, or is under the control of the United States Government; (2) 
falls within one or more of the categories set forth in the Executive Order [Top Secret, Secret, 
and Confidential]; and (3) is classified by an original classification authority who determines that 
its unauthorized disclosure reasonably could be expected to result in damage to the national 
security. 

14. Where such unauthorized disclosure could reasonably to the 

national security, the information may be classified as “ 

safeguarded. Where such unauthorized disclosure could reasonably result in “serious” damage 

to the national security, the information may be classified as “Sects'#-must be properly 

' r 11- 




properly 



5 
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safeguarded. Where such unauthorized disclosure could reasonably result in “exceptionally 
grave?’ tfemagefo^he naikajal gesarity, the information may be classified as “Top Secret” and 
must be properly safeguarded- 

15. Classified rrihrmation, of any designation, may be shared only with persons 

' detemnbfid by an appropriate United States Government official to be eligible for access, and 
who possess a “need to know.” Among other requirements, in order for a person to obtain a 
security clearance allowing thatperson.access to classified United States Government 
infonnation, that person is required to and must agree to properly protect classified information^ 
by not disclosing such information to persons not entitled to receive it, by not unlawfully 
removing classified information from authorized storage facilities, and by not storing classified 
infonnation in unauthorized locations. If a person is not eligible to receive classified 
information, classified information may not be disclosed to that person. In order for a foreign 
government to receive access to classified information, the originating United States agency 
must determine that such release is appropriate. 

16. Pursuant to Executive Order 13526, classified infonnation contained on 
automated infonnation systems, incfridw >g networks and telecommunications systems, that 
collect, create, communicate, computer cfffscjifUtite, process, or store classified information must 
be maintained in a manner that: (1) prevcn&sccess by unauthorized persons; and (2) ensures the 
integrity of the information. 

17. 32 C.F.R. Parts 2001 and 2003 regulate the handling of classified information. 
Specifically, 32 C.F.R. § 2001.43, titled "Storage,” regulates the physical protection of classified 
information. This section prescribes that Secret and Top Secret information “shall be stored in a 
GSA-approved security container, a vault built to FetkstcJ Standard (FED STD) 832, or an open 


6 
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. storage area constructed in accordance with § 2001.53.” It also requires periodic inspection of 
the container and the use of an Intrusion Detection System, among other things. 

18. As used herein, the following terms have the following meaning: 

a. ' “Computer” means an electronic, magnetic, optical, electrochemical, or 
other high speed data processing device performing logical, arithmetic, or storage functions, and 
includes any data storage facility or communications facility directly related to or operating in 
conjunction with such device. See 18 U.S.C. § 1030(e)(1). 

b. “Directory” or “folder” means a simulated electronic file folder or 
container used to organize files and directories in a hierarchical or tree-like structure. 

c. “Electronically Stored Information” or “ESI” includes, consistent with 
Federal Rule of Criminal Procedure 41 and the Advispry Committee Comments to the 2009 
amendments, writings, drawings, graphs, charts, photographs, sound recordings, images, and 
other data or data compilations stored in any medium from which information can be obtained, 
including all types of computer-based information as may be developed over time. “Computer 
data” as used herein is synonymous with BSI. 

d. ‘ ‘Tile” means a collection of related data or information stored as a unit 
under a specified name on storage medium. Not all ESI is stored in files. 

PROBA BLE CAUSE F OB-SEARCH 

19. At all times relevant to tins affidavit, Clinton anc j | ad security clearances, 

as described in paragraph 15 above. 

20. As a result of a records request from the State Department, Clinton produced to 
the State Department approximately 30,490 email communications sent to or from Clinton at the 
@clintonemail.com domain that resided on Clinton’s Server. As a result of a FOIA requssf. the 


b6 • | 

b7C j 

OTHER Sealed 


7 
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« ♦ ^ - 

* 1 , 

• ♦ * * 

) 


State Department ultimately reviewed these 30,490 emails, lie FOIA process % 

the State Deg*g£&&3Rt required that these emails be reviewed by government agensfes fbr 

MB 

classified information prior to public release. In February 2016, the State Department completed 
its review and determined that 2,115 of the 30,490 emails contain information that is presently 
classified Out of these 2,115 emails, the State Department determined that 2,028 emails contain 
information classified at the Confidential level; 65 contain information classified at the Secret 
level; and 22 contain information classified at the Top Secret level. The State Department did 
not make a determination as to whether the information in these emails was classified at the time 
that the emails were sent 


21. The U.S. Government’s determination that 2,028 emails contain information 
classified at the Confidential level is significant because it means that fire unauthorized 
disclosure of those emails could result in damage to national security. The U.S. Government’s 
determination that 65 emails contain information classified at the Secret level is significant 
because it means that the unauthorized disclosure of those emails could result in serious damage 
to national security. The U.S. Government’s determination that 22 emails contain information 
classified at the Top Secret level is significant because it means that the -unauthorized disclosure 
of those emails could result in exceptionally grave damage to national security. 

22. In conjunction with this investigation, the FBI sought a determination by the 
relevant original classification authorities as to whether certain of the 30,490 emails contained 


classified infonnaflott .v^F^time they were sent. In response to the FBFs requests for ' 
classification dftmnjmfww. the relevant original classification authorities determined that 81 


8 
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email'chains, 1 which the FBI investigation determined were transmitted and stored on the 
Clinton Server, contained classified information ranging from the Confidential to Top 
Secret/Special Access Program levels at the time they were sent between 2009 and 2013. The 
relevant original classification authorities determined that information in 68 of these email chains 
remains classified. 

23. 


24. The FBFs investigation determined thaj 




b6 
b7C 
OTHER Sealed 




arious email 


accounts, typically communicated with Clinton’s @c!intonemail.com email account on a daily 
basis. Analysis of emails ia the FBI’s possession revealed more than 4,000 work-related emails 


b6 
b7C 
OTHER Sealed 


1 For the purpqse of the FBI investigation, an email chain is defined as a set of emails having the same initial email. 
The subj ect line may be edited in these chains to reflect the purpose of the forward or reply, 


9 
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"i 




betwi 



25. The FBI’s investigation establisheg^^31^.^chains containing classified 
information, as determined by the relevant original classification authorities, have been 

^jffld/oi j^ R ecounts. Out of the 27 email 


transmitted through 


chains, six email chains contained information that was classified at the Secret level at the time 
the emails were sent, and information in four of those email chains remains classified at that 
level now, while two email chains contain information that is currently classified at the 
Confidential level. Information in the remaining 21 email chains was classified at the 
Confidential level at the time the emails were sent, and of those 21 email chains, information in 
16 of them remains classified as Confidential. 

26. Given the information indicating that there are thousands o t | j jm a 


rails 


-located on the Subject Laptop—including emails, during and arounc 



[roipj recount as well as i 


ccount appearing 

nd Clinton, there 

to belong tc 


and the regular email correspondence betweei 



is probable cause to believe that the Subject Laptop contains correspondence between 


and Clintod 


Because it has been determined by 


relevant original classification authorities that many emails were exchanged betweed 


using 


Ind/od 


pcounts, and Clinton that contain classified 


information, there is also probable cause to believe that the correspondence between them 
located on the Subject Laptop contains classified information which Was produced by and is 
owned by the U.S. Government. The Subject Laptop was never authorized for the storage or 
transmission of classified or national defense information. 

27. A complete forensic analysis and review of the Subject Laptop will also allow the 


b6 | 

b7C I 

OTHER Sealed 


b6 

b7C 

OTHER Sealed 


b6 j 

b7C | 

OTHER Sealed 


10 
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FBI to determine if there is any evidence of computer intrusions into the Subject Laptop, and to 
determine if classified information was accessed by unauthorized users or transferred to any 
other unauthorized systems. 

PROCEDURES FOR SEARCHING BSI 
Review of ESI 

28. Law enforcement personnel (including, in addition to law enforcement officers 
and agents, and depending on the nature of the ESI and the status of the investigation and related 
proceedings, attorneys for the government, attorney support staff, agency personnel assisting the 
government in this investigation, and outside technical experts under government control) will • 
review the ESI contained on the Subject Laptop for inforffijtejfriisesponsive to the warrant. 

29. In conducting this review, law enforcement may use various techniques to 


determine which files or other ESI contain evidence, contraband, fruits, and/or other items 
illegally possessed in violation of the Subjeot Offenses. Such techniques may include; for 
example: 


• surveying directories or folders and the individual files they contain'(analogous to 
looking at the outside of a file cabinet for the markings it contains and opening a 
• drawer believed to contain pertinent files); 


conducting a file-by-file review by “opening” or reading tire j«st such 

files in order to determine their precise contents (analogous to 
examination of each document in a file cabinet to determine its reTcvahoe); 


“scanning” storage areas to discover and possibly recover recently tTelS&ii date; 
scanning storage areas for deliberately hidden files; an# 1 " ,r 


■ ■ i —^ 

• performing electronic keyword searches through all elecjr«nicsfeH^gi^t^3 to 
determine the existence and location of search terms rel«jg$l 
file investigation. (Keyword searches alone are typically inadequate to detect all 
information subject to seizure. For one thing, keyword searches work only for text 
data, yet many types of files, such as images and videos, do not store data as 
searchable text. Moreover, even as to text data, there may be information properly - 
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subject to seizure but that is not captured by a keyword search because the 
information does not contain the keywords being searched.) • 

3 0. Law enforcement personnel will make reasonable efforts to restrict their search to 
data falling within the categories of evidence specified in the warrant. 

Return of the Subject Laptop 

31. If the Government determines that the Subject Laptop is J3tzb®%pr necessary to 

retrieve and preserve the data on the device, and that the Subject Laptop ||;cj||gubject to seizure 
pursuant to Federal Rule of C rimin al Procedure 41(c), the Government will return the Subject 
Laptop. Computer data that is encrypted or unreadable will not be returned unless law 
enforcement personnel have determined that the data is not (i) an instrumentality of the offense, 
(ii) a fruit of foe criminal activity, (iii) contraband, (iv) otherwise unlawfully possessed, or (v) 
evidence of the subject offenses. . 

gPNCLUSION '• 

32. Based on the foregoing, I respectfully request the Court to issue a warrant to seize 
foe items and information specified in Attachment A to this affidavit and to the Search and 


Seizure Warrant. 
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Attachment A- 


I. Device To Be Searched 

The tkffSM’p be s earched is a silver Dell Inspiron IS 7000 Series (7548) laptop computer 
bearfofea yilco tad fmntaining a Toshiba one terabyte hard drive bearing serial 

niunbej Ithe Subject Laptop), and that is currently housed at the Federal 

Bureau ot investigation, New York Field Office, 26 Federal Plaza, New York, New York 

102ft. 

II. Review of ESI on the Subject Devices 

Law enforcement personnel (including, in addition to law enforcement officers and 
agents, and depending on the nature of the ESI and the status of the investigation and related 
proceedings, attorneys for the government, attorney support staff sg&sr.y personnel assisting the 
government in this investigation, and outside technical experts uncrw swermnent control) are 
authorized to review the ESI contained on the Subject Laptop for Showing evidence, 

contraband, fruits, and/or other items illegally possessed in violation of Title 18, United States 
Code, Section 793(e) and (f) (the Subject Offenses): 

• iHgKgS* 

, Data and information associated with the operation, use, maintenance, backup, 
auditi«-;i pi security functions of the Subject Laptop including, but not limited to: 

a. Emails and attachments, in any form; 

b. User and system files stored on the laptops, frjifiarfjng file fragments and 
items carved from unallocated space; 

o. Logs, configuration files, and backups; 

d. Executable code and scripts; and 

e. Documents, database files, and spreadsheets; 

2. Data and information electronically stored on the Subject Laptop related to 
communications with email accounts used by former Secretary of State Hillary Clinton during 
her tenure as Secretary of State; 

3. Data and information on the Subject Laptop that might identify the person or 
persons who accessed classified information present on the Subject Laptop, including names, 
addresses, telephone numbers and other identifiers, email addresses, business information, the 
length of service (including start date), types of services utilized, means and source of payment 
for services (including any credit card or bank account number), and information about any 
domain name registration; and 

4. Data and information stored on the Subject Laptop that might identify activity 
related to a computer intrusion, including, but not limited to evidence of malware or viruses, 
executable code or scripts, log files, audit files, system files, user and account information, IP 
addresses, computer hardware addresses, intrusion-detection logs, firewall and other network 
logs, anti-virus logs or anti-malware logs. 


b6 

b7C 

OTHER Sealed 
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HI. Seizure for Later Review ofMecteatoafty StoredXu&rmation 

• | tf r ' 1 ¥ * ' * * I 

. A. Seizure of Computer, asul Media *. 

'.* * ' » ^ j* 

This warrant authorizes the ssjssfci of a. computer anti electronic storage media as set 
forth below. In lieu of seizing any jStrtloaist £5£cfrons& storage media, this warrant also, 
authorizes the copying of electronically iStm! h^craufSLon. for later review. Electronic storage 
media which may be seized or copied inafoda witWil 

Computer devices, electronic media and electronic storage devices, including, but not 
limited to, a computer, disk drives, modems, thumb drives, personal digital assistants, smart 
phones, digital cameras, and scanners and the data within the aforesaid objects relating to said 
materials, which may contain information within the scope of this warrant. 

^ Any physical keys, encryption devices, and similar physical items that are necessary to 
gain access to the computer equipment, storage devices or data mentioned above, or any 
passwords, password files, test keys, encryption codes or other information necessary to access 
the above-mentioned computer equipment, storage devices or data. 

B. Review of Electronic Storage Media and Electronically Stored Information 

' Following creation of forensic Image copies as may lie necessary to preserve the integrity 
of seized electronically stored infonnstkm, law color s-ants#potsonnel (who may include, in 
addition to law enforcement officers and agents, attorneys for the government, attorney support 
staff, and outside technical experts under government control) are authorized to review the seized 
information for information and data within the scope of this warrant 

In conducting this review, law en&rwnvjnt prffsoiuiel trtay use various techniques to 
determine which files or other ESI coniaia evidence, contraband, fruits and/or other items 
illegally possessed in violation of the Subject Offenses. Such techniques may include, but shall 
not be limited to, surveying various file directories or folders and the individual files they 
contain; conducting a file-by-file review by “opening” or reading the first few “pages” of such 
files in order to determine their precise contents; “scanning” storage areas to discover and 
possibly recover recently deleted data; scanning storage areas for deliberately hidden files; and 
performing electronic “key word” searches through all electronic storage areas to determine 
whether occurrences of language contained in such storage areas exist that are related to the 
subject matter of the investigation, Forensically trained law enforcement personnel may also 
search for and attempt to recover “deleted,” “hidden,” or encrypted data to determine whether the 
data falls within fee list of items to be seized as set forth in this affidavit. ESI feat is responsive 
to the warrant will be identified and/or copied for further use in fee investigation and any 
resultant prosecution. 
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AO 93 (Rov. 01 / 09 ) Search and SoisuwW«*iant(Paf:o 2) 


Return 


Case No,: Date and time warrant exeouted: 

16 MAG 7063 _ 10/30/2016 1:67 pm 

Inventory made in the presence of: ‘ 1 

Inventory of the property taken and name of any person(s) seized: 


Copy of 

ss/i 


1 left with: - 


b6 ‘ 
b7C 

OTHER Sealed 


Forensic image of; 
bearing servlcaiad 
serial numben 


I Insplron 15 7000 Series (7548) laptop computer 
pontainlng a Toshiba one terabyte hard drive bearing 


b6 

b7C 

OTHER Sealed 


erttfication 
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